Webhooks

Task timeout notification

Sent to a configured webhook endpoint subscribed to task.timeout. Verify the HMAC-SHA256 signature over the timestamp, a period, and the raw request body using the signing secret. Return 2xx promptly and deduplicate by event ID. See https://tokenlab.sh/docs/en/guides/webhooks for signature verification and delivery recovery.

postWebhooktaskTimeout

Headers

X-Webhook-IDstring required

Matches the event id in the request body.

X-Webhook-Timestampstring required

Delivery attempt timestamp in Unix seconds.

X-Webhook-Signaturestring required

HMAC-SHA256 signature using the complete whsec_ signing secret.

Payload

idstring required

Stable event ID for deduplication at the receiving endpoint.

type'task.timeout' required

createdinteger required

Event creation time in Unix seconds.

Response

Notification accepted by the receiving endpoint.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.